CVE-2019-12456

An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a "double fetch" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1717182
• https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=5.3/scsi-queue&id=86e5aca7fa2927060839f3e3b40c8bd65a7e8d1ePatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDURACJVGIBIYBSGDZJTRDPX46H5WPZW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBJHGQXA4PQ5EOGCOXEH3KFDNVZ2I4X7/
• https://lkml.org/lkml/2019/5/29/1164Mailing List, Third Party Advisory
• https://support.f5.com/csp/article/K84310302
• https://support.f5.com/csp/article/K84310302?utm_source=f5support&amp%3Butm_medium=RSS
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1717182
• https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=5.3/scsi-queue&id=86e5aca7fa2927060839f3e3b40c8bd65a7e8d1ePatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDURACJVGIBIYBSGDZJTRDPX46H5WPZW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBJHGQXA4PQ5EOGCOXEH3KFDNVZ2I4X7/
• https://lkml.org/lkml/2019/5/29/1164Mailing List, Third Party Advisory
• https://support.f5.com/csp/article/K84310302
• https://support.f5.com/csp/article/K84310302?utm_source=f5support&amp%3Butm_medium=RSS

Published

May 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1245An information disclosure vulnerability exists when DirectWr…6.5
• CVE-2019-12450file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 throu…9.8
• CVE-2019-12452types/types.go in Containous Traefik 1.7.x through 1.7.11, w…
• CVE-2019-12453In MicroStrategy Web before 10.1 patch 10, stored XSS is pos…
• CVE-2019-12454An issue was discovered in wcd9335_codec_enable_dec in sound…
• CVE-2019-12455An issue was discovered in sunxi_divs_clk_setup in drivers/c…
• CVE-2019-12457FileRun 2019.05.21 allows images/extjs Directory Listing. Th…5.3
• CVE-2019-12458FileRun 2019.05.21 allows css/ext-ux Directory Listing. This…5.3
• CVE-2019-12459FileRun 2019.05.21 allows customizables/plugins/audio_player…5.3
• CVE-2019-1246A remote code execution vulnerability exists when the Window…7.8
• CVE-2019-12460Web Port 1.19.1 allows XSS via the /access/setup type parame…
• CVE-2019-12461Web Port 1.19.1 allows XSS via the /log type parameter.